Unable to connect to mysql in Istio environment

1
votes

We have configured the Kubernetes cluster on bare-metal server with v1.15.1 and Istio-1.4.0 (demo) with mTLS enabled. And our mysql server is outside the K8s cluster on Azure VM's. Now when we inject istio-proxy while deploying the application we are unable to connect to mysql server via jdbc and also tried my mysql client. But when remove the istio-proxy by re-deploying we are able to connect instantly with out any issue.

When through many blogs wrt istio and mysql, tried with removing the default mesh policy but tht didnt work. The case in istio faq's is when the mysql is in k8s cluster with istio injected.

2
kubernetesistio
Look into adding a ServiceEntry for the external MySQL (see this post here). – char
Hi, like @char mentioned using ServiceEntry is simpler solution rather than making mysql connection mTLS friendly. However i suggest using current documentation example instead. The blog post from 2018 might be outdated. What istio version do You have? – Piotr Malec
try also setting values.global.mtls.auto=true this will use mtls only when possible – Tummala Dhanvi
@char .. we tried with ServiceEntry. First we created a service and endpoint for our mysql server and the added the serviceentry and destinationrule (tls disabled) – Ankit Saxena
@AnkitSaxena: Use istioctl manifest apply --set profile=demo \ --set values.global.mtls.auto=true to enable the setting talked about. Have you tried it with just a ServiceEntry, without a DestinationRule and restarting the pods after adding everything? – char

2 Answers

0
votes

You can configure auto-mtls for istio by configuring values.global.mtls.auto=true (ie it uses mtls when possible and falls back for other connections

https://istio.io/docs/tasks/security/authentication/auto-mtls/

0
votes

Serviceentry and destionation rule does the work form my case